How to use Custom AuthorizeAttribute for controller utilizing parameter value?

Question

I am trying to secure a controller action to prevent a user from accessing an Entity that they do not have access to. I am able to do this with the following code.

public ActionResult Entity(string entityCode)
{
    if (CurrentUser.VerifyEntityPermission(entityCode))
    {
        //populate viewModel...
        return View(viewModel);
    }
    return RedirectToAction("NoAccessToEntity", "Error");
}

I would like to be able to add an attribute to the controller action itself. In order to validate the access to the entity, I need to see what value has been passed to the controller and what entities the user has access to. Is this possible?

[EntityAuthRequired]
public ActionResult Entity(string entityCode)
{
        //populate viewModel...
        return View(viewModel);
}

how you did that

Dragon
– Dragon

2017-04-06 13:09:55 +00:00
Commented Apr 6, 2017 at 13:09 — Dragon
– Dragon, Commented Apr 6, 2017 at 13:09

RSolberg · Accepted Answer · 2010-05-13 00:51:17Z

3

Something like this might help you on your way. Though you may want to add some additional properties to your attribute to allow you to specify your entityCode parameter on each action, rather than hard-code it.

public class EntityAuthRequired : FilterAttribute, IAuthorizationFilter 
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        //Make sure that this is not NULL before assigning value as string...
        var entityCode = filterContext.RouteData.Values["entityCode"] as string;
        // do your logic...         
        if (!allowed)
            filterContext.Result = new HttpUnauthorizedResult();            
    }
}

Also, if the entityCode isn't in your RouteData, you can use filterContext.RequestContext.HttpContext.Request to look at the POST data.

edited May 13, 2010 at 0:51

RSolberg

27k23 gold badges120 silver badges160 bronze badges

answered May 12, 2010 at 21:28

Jab

13.8k2 gold badges45 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Dragon Over a year ago

how to get controller post json values in Authorizeattribute.and in AuthorizeRequest method

Collectives™ on Stack Overflow

How to use Custom AuthorizeAttribute for controller utilizing parameter value?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related